Commit 0c77b3c0 authored by reimar's avatar reimar

Change buffer size checks to avoid the undefined overflow case.


git-svn-id: file:///var/local/repositories/ffmpeg/trunk@19047 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b
parent 295c3ee2
...@@ -87,7 +87,7 @@ static unsigned int mszh_decomp(unsigned char * srcptr, int srclen, unsigned cha ...@@ -87,7 +87,7 @@ static unsigned int mszh_decomp(unsigned char * srcptr, int srclen, unsigned cha
continue; continue;
} }
if ((mask & (1 << (--maskbit))) == 0) { if ((mask & (1 << (--maskbit))) == 0) {
if (destptr + 4 > destptr_end) if (destptr_end - destptr < 4)
break; break;
memcpy(destptr, srcptr, 4); memcpy(destptr, srcptr, 4);
srclen -= 4; srclen -= 4;
...@@ -101,7 +101,7 @@ static unsigned int mszh_decomp(unsigned char * srcptr, int srclen, unsigned cha ...@@ -101,7 +101,7 @@ static unsigned int mszh_decomp(unsigned char * srcptr, int srclen, unsigned cha
ofs &= 0x7ff; ofs &= 0x7ff;
srclen -= 2; srclen -= 2;
cnt *= 4; cnt *= 4;
if (destptr + cnt > destptr_end) { if (destptr_end - destptr < cnt) {
cnt = destptr_end - destptr; cnt = destptr_end - destptr;
} }
for (; cnt > 0; cnt--) { for (; cnt > 0; cnt--) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment